diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index f553fe7..2f9bc02 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -16,6 +16,12 @@ on:
   workflow_dispatch:
 
 permissions:
+  # `actions: read` is required by the reusable workflow's CodeQL + SARIF-upload
+  # jobs (they declare it for github/codeql-action telemetry). An explicit
+  # permissions block sets every unlisted scope to `none`, so without this the
+  # nested jobs request more than the caller grants and the run is rejected at
+  # creation (startup_failure). Read-only; grants no write capability.
+  actions: read
   contents: read
   security-events: write
   pull-requests: read
@@ -26,7 +32,7 @@ jobs:
     # startup-fails for Dependabot's restricted context, which blocks Dependabot's own security
     # PRs. Dependabot already vetted the bump; push/schedule still scan the default branch.
     if: ${{ github.actor != 'dependabot[bot]' }}
-    uses: resq-software/.github/.github/workflows/security-scan.yml@94363a6a6856b7d86aceac91c4ff7df4bc19ced9 # main
+    uses: resq-software/.github/.github/workflows/security-scan.yml@44987ffd6eb5b1aa9d0a0d39e8dde9d669fe1d84 # main
     with:
       languages: '["actions"]'
       enable-semgrep: true